Authentication
Authenticate server-side requests with a secret API key.
Keep API keys on your server. Never put them in browser code, mobile apps or public repositories.
API keys
Create keys in the dashboard under Developers → API keys. Each key belongs to one environment, which you can tell from its prefix:
| Environment | Key prefix |
|---|---|
| Sandbox | mpb_test_ |
| Live | mpb_live_ |
The full key is shown once, when you create it. MigraPay stores only a hash, so a lost key cannot be recovered: revoke it and create a new one. The dashboard lists each key by its first characters (for example mpb_live_Q3x9aB) so you can tell them apart.
Send an authenticated request
Send the key in the Authorization header as a bearer token:
curl https://business-api.migrapay.com/v1/api/wallets \
-H "Authorization: Bearer $MIGRAPAY_API_KEY"You can send the key in an X-API-Key header instead. If both headers are present, X-API-Key is used.
curl https://business-api.migrapay.com/v1/api/wallets -H "X-API-Key: $MIGRAPAY_API_KEY"Scopes
Each key carries the scopes you pick when you create it. Give every integration only the scopes it needs: a reporting job needs payment.view, not payment.create. The API reference lists which endpoints each scope opens.
Key security
- Store keys in environment variables or a secret manager, never in source code.
- Use separate keys per service so you can revoke one without touching the others.
- Rotate keys by creating a new key, deploying it, then revoking the old one.
- Revoke a key immediately in the dashboard if you think it has leaked.
Restrict Live keys by IP
Under Settings → API & integrations you can list the IP addresses your servers call from. Live keys used from anywhere else get 403 IP_NOT_ALLOWED. Sandbox keys are never IP-restricted.
Authentication errors
A missing, unknown or under-scoped key gets a 401 or 403; the codes are in the API reference.